A security update has been released for AlmaLinux 10, which addresses several vulnerabilities in the Linux kernel. The update fixes issues with drm/vkms, udmabuf, net/sched, and drm/gem, including use-after-free and double-free errors, buffer size overflows, and notifications not being passed when child classes become empty. The CVEs for these vulnerabilities are CVE-2025-22097, CVE-2025-37803, CVE-2025-38350, and CVE-2025-38449.

ALSA-2025:15447: kernel security update (Important)

ALSA-2025:15447: kernel security update (Important)

Hi,

You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux.

AlmaLinux: 10
Type: Security
Severity: Important
Release date: 2025-09-15

Summary:

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097)
* kernel: udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803)
* kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350)
* kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2025-15447.html

This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/.
Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org.

Kind regards,
AlmaLinux Team